Subprocessor List
This list summarises the third-party that may support Votivus Consulting Limited's services and operations.
Last updated: 17 July 2026
1. Our current sub-processors and service providers
| Provider | Category | Role | Personal data involved | Location / hosting region | Transfer mechanism |
|---|---|---|---|---|---|
| Cloudflare | Hosting, security, CDN | Processor | Account, engagement, technical, and log data for our website and client portal | Global network (US-headquartered provider) | Standard Contractual Clauses |
| Our application/data platform | Application platform / data storage | Processor | Account and engagement data submitted through our website and portal | Provider-managed infrastructure | Standard Contractual Clauses, where applicable |
| Stripe | Payments | Processor / independent controller (for its own compliance obligations) | Billing and transaction data; card data is handled by Stripe and not stored by us | Global (US-headquartered provider) | Standard Contractual Clauses / EU–US Data Privacy Framework, where applicable |
| Google Analytics | Analytics / performance | Processor or independent controller, depending on configuration | Technical and usage data (subject to cookie consent) | Global (US-headquartered provider) | Standard Contractual Clauses / EU–US Data Privacy Framework, where applicable |
| Attio | CRM / outreach | Processor | Prospect and client contact data | Provider-managed infrastructure | Standard Contractual Clauses, where applicable |
| Anthropic | AI-assisted analysis (third-party) | Processor | Only information that is already publicly available (see note below) | US-headquartered provider | Standard Contractual Clauses / EU–US Data Privacy Framework, where applicable |
| Perplexity | AI-assisted analysis (third-party) | Processor | Only information that is already publicly available (see note below) | US-headquartered provider | Standard Contractual Clauses / EU–US Data Privacy Framework, where applicable |
| Our own self-hosted AI infrastructure | AI-assisted analysis (in-house) | Not a sub-processor: processed on our own infrastructure, described in the DPA Annex 2 | All data that is not already publicly available, including internal, private, or otherwise non-public Client data | United States (equipment owned and operated by Votivus) | Not a third-party transfer; see DPA section 13 for the safeguards that apply to Votivus's own cross-border processing |
How we split AI processing between providers. We draw a firm line based on whether information is already publicly available. Anything that is not independently discoverable by the public (your internal business data, analytics, ad account data, CRM data, and anything else you give us that isn't already public) is processed exclusively on our own self-hosted infrastructure and is never sent to Anthropic, Perplexity, or any other third-party AI provider. Only information that is already publicly available (for example, public website content or public company information) may additionally be processed using Anthropic or Perplexity, under business/commercial-tier accounts with a contractual no-training-on-our-data commitment.
This table reflects our providers as of the date above. We keep it accurate and update it when our providers change, following the notice process in section 4.
2. Categories of providers we use
| Service category | Typical role | Personal data | Notes |
|---|---|---|---|
| Hosting / infrastructure / CDN | Processor | Account, engagement, technical, log data | Cloudflare runs the website, portal, and tools |
| Application platform / data storage | Processor | Account, engagement, operational data | See section 1 |
| Payments | Processor or independent controller | Billing & transaction data | Stripe; card data handled by Stripe, not stored by us |
| Analytics / performance | Processor or independent controller | Technical/usage data | Google Analytics, subject to cookie consent |
| CRM / outreach | Processor | Prospect & client contact data | Attio |
| AI-assisted analysis (third-party) | Processor | Public information only (see section 1) | Anthropic, Perplexity; bound under Article 28 GDPR / equivalent contractual terms |
| AI-assisted analysis (in-house) | N/A: processed on our own infrastructure | Non-public Client data | No transfer to a third party and no sub-processor for this step; located in the United States (see section 1 and the DPA) |
| Business-data / enrichment | Processor or independent controller | Professional contact & company data | Sources outreach data, where used |
Where we transfer personal data outside the EEA, we rely on adequacy (including the EU–US Data Privacy Framework where the recipient is certified), the SCCs with any required supplementary measures, or another Chapter V mechanism; SCCs are kept as a fallback for US providers.
3. Professional advisers and legal recipients
We may also disclose personal data to accountants, auditors, lawyers, insurers, banks, regulators, courts, or authorities where reasonably necessary for compliance, accounting, legal claims, risk management, or lawful requests. These act as independent controllers for their own purposes.
4. Changes and notification
Where a change affects personal data we process on a client's behalf under a DPA, we give notice as that DPA requires, for material new or replacement sub-processors (a "material" change has the meaning given in our Terms of Service), at least 10 days before the change takes effect where reasonably possible, unless urgent security, continuity, or legal reasons require less. Clients may object on reasonable data-protection grounds as set out in the DPA. To be notified, email info@votivusconsulting.com and ask to join sub-processor change notifications.
Votivus Consulting Limited: Subprocessor List.